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TITLE OF THE INVENTION 
COMPUTER VIRUS INFECTION INFORMATION PROVIDING 
METHOD, COMPUTER VIRUS INFECTION INFORMATION 
PROVIDING SYSTEM, INFECTION INFORMATION PROVIDING 
5 APPARATUS, AND COMPUTER MEMORY PRODUCT 

BACKGROUND OF THE INVENTION 
Field of the Invention 

The present invention relates to a computer virus infection 

10 information providing system for detecting a computer virus in 
information transmitted between a terminal apparatus and a 
central apparatus and providing infection information concerning 
the detected computer virus, and in particular, to a computer virus 
infection information providing system for providing the time of the 

15 infection and route of infection as infection information and thereby 
providing information on how the user terminal apparatus was 
infected with the computer virus. 

Description of the Prior Art 

20 In recent years, computer viruses which invade computers 

from the Internet or computer memory products such as floppy 
disks and prevent normal operation of the computers intentionally 
are spreading. These computer viruses infect not only an initially 
infected computer but also the other computers. Thus, when a 

25 computer virus of new kind is found out, an appropriate anti-virus 
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software is prepared immediately. The anti-virus software is 
distributed to users. 

The anti -virus software is generally installed on user 
terminal apparatuses. Each terminal apparatus performs virus 
5 check every predetermined time interval or every time of file 
operation. As the result of virus check, the terminal apparatus 
detects the computer virus. 

Further, recently, there is computer virus that attaches the 
computer virus as the attached file of an e-mail transmitted via the 

10 Internet, and distributes the attached file to the third party 

^discriminatingly. In order to treat such computer viruses, an 
Internet service provider (ISP, hereafter) installs anti-virus 
software in a central apparatus. Then, the central apparatus 
performs virus check on the files passing through the network, 

15 thereby blocking the further infection of the computer virus. 

However, in the prior art, even when the central apparatus 
has detected the presence of a computer virus in the information 
transmitted by a user, the user is merely informed of the detection 
of the computer virus. This leaves the problem that the user 

20 cannot understand when and from where the computer virus 

invaded his or her terminal apparatus. In particular, considering 
the increasing number of cases of infection via the Internet, it is 
desired to provide detailed infection information to the users. 

Further, it is effective that anti-virus software of the latest 

25 version is installed also in user terminal apparatuses in addition to 
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the central apparatus of the ISP. However, after initial 
installation of anti-virus software prepared by anti-virus software 
house, only a few users update the anti-virus software. This 
causes the problem of inefficiency in removing computer viruses. 
5 Furthermore, development of anti-virus software needs a 

large cost. Nevertheless, ordinary users are not willing to pay for 
the update of the anti- virus software after initial installation of the 
anti-virus software. Such a situation has exacerbated the 
profitability of anti-virus software houses. 

10 In addition, each ISP desires superiority to the other ISP's 

and a higher added value. For the purpose of this, ISP's have 
desired to construct a system for providing detailed computer virus 
infection information to the users. Further, ISP's have desired to 
construct a system for distributing the latest version of anti-virus 

15 software to each user and for collecting the development cost of the 
anti-virus software. 

BRIEF SUMMARY OF THE INVENTION 
The present invention was implemented in view of the above 
20 circumstances. 

A first object of the invention is to provide a computer virus 
infection information providing system in which a central apparatus 
monitors the communication history of the user terminal 
apparatuses and provides infection information such as the time of 
25 infection to the users, whereby the users can easily understand the 
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time of infection, and whereby an ISP can obtain a high added 
value. 

A second object of the invention is to provide a computer 
virus infection information providing system in which both the time 
5 of find-out of a computer virus and the time of installation of 

anti-virus software are taken into consideration, whereby the time 
of infection can be specified more precisely. 

A third object of the invention is to provide a computer virus 
infection information providing system for providing also the 
10 information on the route of computer virus infection and thereby 
permitting easier determination of the cause of computer virus 
infection. 

A fourth object of the invention is to provide a computer 
virus infection information providing system for distributing 
15 anti-virus software only to predetermined users and thereby 
permitting reliable collection of the development cost of the 
anti- virus software. 

A fifth object of the invention is to provide a computer virus 
infection information providing system in which user terminal 
20 apparatuses also perform virus check, whereby the time of infection 
is specified based on the result, whereby the specified time of 
infection is provided as the infection information to the users, and 
whereby the precision in time of infection is improved. 

A sixth object of the invention is to provide a computer virus 
25 infection information providing system for providing the advertising 
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information concerning anti-virus software to those users not yet 
having the anti-virus software and thereby promoting the sale of 
the anti- virus software. 

In the present invention, anti-virus software for detecting 
5 computer viruses is installed in a central apparatus (infection 
information providing apparatus). The central apparatus stores 
the communication history of the information transmitted from the 
terminal apparatuses connected via a communication network. 
When the installed anti-virus software detects a computer virus in 

10 the transmitted information, the central apparatus specifies the 
time of infection based on the stored communication history. 

The central apparatus stores the time data transmitting the 
information as the communication history. In the following 
description, assumed is the case that no computer virus was 

15 detected when a terminal apparatus transmitted information at the 
previous time, but that a computer virus is detected when the 
terminal apparatus transmitted information at the present time. 
In this case, the time of infection is specified to be between the time 
when the terminal apparatus transmitted information at the 

20 previous time and the time when the terminal apparatus 

transmitted information at the present time. Further, the route of 
infection is specified to be a route via another ISP or a computer 
memory product. The central apparatus transmits the infection 
information including the specified time of infection, to the terminal 

25 apparatus. The transmitted contents include the time of infection 
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and the name of the computer virus of infection. 

The terminal apparatus displays the transmitted infection 
information including the time of infection. This gives detailed 
computer virus information to the user. Further, the user can 
5 easily specify the cause of infection. 

In particular, by providing the detailed infection information, 
the ISP can obtain superiority to the other ISP's and a considerably 
high added value. 

Further, in the present invention, the time when the 
10 anti-virus software house or the ISP found out the computer virus is 
taken into consideration in order to specify the time of infection. 
That is, computer viruses gradually spread out after the first 
find-out. Accordingly, user terminal apparatuses are rarely 
infected with a computer virus before the find-out of the computer 
15 virus. In other words, the time of infection is rarely before the 
find-out of the computer virus. 

Furthermore, the time when the anti-virus software against 
the found-out computer virus was installed in the central apparatus 
is taken into consideration in order to specify the time of infection. 
20 That is, after the anti-virus software was installed in the central 

apparatus, the computer virus is completely blocked in the route via 
the central apparatus. 

Accordingly, when a computer virus is detected, the 
possibility of the time of infection critically depends on whether the 
25 time of the previous information transmission is before or after the 



installation of the anti-virus software. In case that the time of the 
previous information transmission is after the installation of the 
anti-virus software, it is concluded that there was no infection with 
the computer virus at the previous time. Thus, the infection is 
specified to have occurred between the time of the previous 
information transmission and the time of the present information 
transmission, via another ISP or a computer memory product. 

On the other hand, in case that the time of the previous 
information transmission is before the installation of the anti-virus 
software, the time of infection is specified to be between the time of 
find-out of the computer virus and the time of the present 
information transmission 

As such, in the present invention, in addition to the 
communication history, both the time of find-out of a computer 
virus and the time of installation of anti-virus software are taken 
into consideration in order to determine the precise time of infection. 
Consequently, in accordance with the present invention, the time of 
infection can be specified more precisely. Further, the user can 
specify the cause of infection more easily. 

Further, in the present invention, the route of infection of a 
computer virus is specified based on both the stored communication 
history and the time of installation of anti-virus software. That is, 
in case that no computer virus was detected when a terminal 
apparatus transmitted information at the previous time after the 
installation of the anti- virus software in a central apparatus, but 
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that a computer virus is detected when the terminal apparatus 
transmitted information at the present time, rejected is the 
possibility that the terminal apparatus was infected via the central 
apparatus (the ISP in question). (That is, the terminal apparatus 
5 was infected via another ISP or the like.) 

On the other hand, in case that a computer virus is detected 
when the terminal apparatus transmitted information at the 
present time after the installation of the anti-virus software in the 
central apparatus, and that the time when the terminal apparatus 

10 transmitted information at the previous time was before the 
installation, there remains the possibility that the terminal 
apparatus was infected via the central apparatus (the ISP in 
question) before the installation. 

As such, in the invention, the route of infection of a computer 

15 virus is specified based on both the communication history and the 
time of installation of anti-virus software. In the present invention, 
the route of infection also is provided as the infection information to 
the user, thereby permitting the user to obtain more useful 
information. 

20 Further, in the present invention, a central apparatus 

transmits the anti-virus software only to predetermined terminal 
apparatuses. In each terminal apparatus having received the 
anti-virus software, the anti-virus software is installed. The 
anti-virus software is executed every predetermined time interval, 

25 every time of file operation, or at another timing, thereby storing 



the execution history. When the anti-virus software detects a 
computer virus, the terminal apparatus transmits the stored 
execution history to the central apparatus. 

The central apparatus specifies the time of infection based 
on the execution history and the stored time of find-out. The 
central apparatus further specifies the route of infection based on 
the transmitted execution history. That is, similarly to the 
above-mentioned method, virus check is carried out also in the local 
terminal apparatuses, whereby the information such as execution 
history is collected. The central apparatus specifies the time and 
route of infection based on such information, thereby providing the 
result to the users. 

Accordingly, those users previously having a license contract 
to be provided with the latest versions of the anti-virus software can 
efficiently prevent the infection of computer viruses. Further, in 
the present invention, the time of infection is specified based on the 
result of computer virus check performed in the local terminal 
apparatuses. Accordingly, the time and route of infection can be 
specified in further detail. Furthermore, since the ISP can make a 
license contract with each user, the present invention permits 
reliable collection of the development cost of the anti-virus software. 
Thus, a routine revenue is anticipated every time of occurrence of a 
computer virus. This situation provides a solid ground for the 
operation of the anti-virus software house. 

Further, in the present invention, advertising information 
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concerning anti-virus software is transmitted to terminal 
apparatuses. Such advertising information is provided to those 
users not yet having a license contract for the anti-virus software, 
whereby the number of users having the license contract can be 
5 increased. 

The above and further objects and futures of the invention 
will more fully be apparent from the following detailed description 
with accompanying drawings. 

10 BRIEF DESCRIPTION OF THE SEVERAL VIEWS OF THE 

DRAWINGS 

FIG. 1 is a schematic diagram showing the general 
configuration of a computer virus infection information providing 
system according to the invention; 
15 FIG. 2 is block diagram showing the configuration of a 

central apparatus? 

FIG. 3 is a diagram showing the record layout of anti-virus 
software installation file; 

FIG. 4 is a diagram showing the record layout of a user file; 
20 FIG. 5 is a diagram showing the record layout of a 

communication history storage file; 

FIG. 6 is a flow chart showing the process sequence of a 
computer virus infection information providing system according to 
the invention; 

25 FIG. 7 is a flow chart showing the process sequence of 
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specifying the time of infection and of specifying the route of 
infection; 

FIG. 8 is a diagram showing an example of the display of 
infection information; 
5 FIG. 9 is a diagram showing the record layout of a user file 

according to Embodiment % 

FIG. 10 is block diagram showing the configuration of a 
terminal apparatus according to Embodiment 2; 

FIG. 11 is a diagram showing the record contents of an 
10 execution history file; 

FIG. 12A and B are flow chart showing the process sequence 
of a computer virus infection information providing system 
according to Embodiment % 

FIG. 13 is a diagram showing an illustration of advertising 
1 5 information; 

FIG. 14 is a diagram showing the contents of infection 
information displayed on a display section; 

FIG. 15A and B are flow chart showing the process sequence 
of virus check in a terminal apparatus; 
20 FIG. 16 is a flow chart showing the process sequence of 

specifying the time and route of infection; and 

FIG. 17 is a schematic diagram showing a general 
configuration according to Embodiment 3 of to the invention; 



25 



DESCRIPTION OF THE PREFERRED EMBODIMENTS 
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<Embodiment 1> 

FIG. 1 is a schematic diagram showing the general 
configuration of a computer virus infection information providing 
system according to the invention. In the figure, numeral 1 
5 indicates a central apparatus (this is an infection information 

providing apparatus, but simply referred to as a central apparatus 
hereafter) of an ISP or the like which provides Internet connection 
services. 

Central apparatus 1 is connected through a communication 
10 network N, such as the Internet, to terminal apparatuses 2, 2, 2,... 
such as personal computers and portable terminal apparatuses. 
Each terminal apparatus 2 is provided with a log-in name, an 
e-mail address, and the like after a contract with the ISP. By 
accessing a predetermined access point, terminal apparatus 2 can 
15 net-surf and transmit/receive e-mails via central apparatus 1. 

The present embodiment is described for a system in which 
central apparatus 1 of the ISP and terminal apparatus 2 in each 
home are interconnected via the Internet. However, the invention 
is not restricted to this case, and may be applied to a system in 
20 which a central apparatus 1 of server computer or the like and each 
terminal apparatus 2 of client computer or the like are 
interconnected via a LAN (local area network) of a company or the 
like. 

FIG. 2 is block diagram showing the configuration of a 
25 central apparatus 1. As shown in the figure, a CPU 11 is 
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connected through a bus 17 to^ a RAM 12; a storage section 15 such 
as a hard disk drive; a communication section 16 such as a gateway 
for transmitting and receiving information to and from terminal 
apparatuses 21 a display section 13 such as a liquid crystal display; 
5 and an input section 14 such as a keyboard and a mouse, RAM 12 
stores a control program 12P for controlling storage section 15, 
display section 13, input section 14, and the like. 

Storage section 15 comprises^ anti- virus software installation 
file 151 for installing a prepared anti-virus software; a 

10 communication history storage file 152 for storing the 

communication history of terminal apparatuses 2; and a user file 
153 for storing the log-in name, e-mail address, and the like of the 
users. Here, it is not definitely necessary for these anti-virus 
software installation file 151, communication history storage file 

15 152, and user file 153 to be installed in the storage section 15 of the 
central apparatus 1. These files may be installed in another and 
unshown computer connected via the communication network N, 
and may be read out when necessary. 

When information is transmitted from terminal apparatus 2 

20 to the central apparatus 1, CPU 11 stores the communication 
history into communication history storage file 152. When an 
e-mail having an attached file passes through communication 
section 16 such as a gateway, CPU 11 performs computer virus 
detection using the anti-virus software installed in anti-virus 

25 software installation file 15 L Here, each anti- virus software 
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according to the invention has the function of detecting computer 
viruses. Further, the anti- virus software according to the 
invention may have the function of removing the computer viruses 
in addition to the function of detection. 
5 FIG. 3 is a diagram showing the record layout of anti-virus 

software installation file 151. As shown in the figure, the time of 
find-out of the computer virus and the time of installation of the 
anti-virus software for detecting and removing the computer virus 
are stored corresponding to each anti-virus software code for 

10 specifying each anti-virus software. Although not shown, 
anti-virus software is also installed in anti-virus software 
installation file 151 corresponding to each anti-virus software code. 
Every time when a new computer virus is found out, the function of 
detecting and removing the computer virus is added to the 

15 anti- virus software. 

FIG. 4 is a diagram showing the record layout of user file 153. 
As shown in the figure, a password, an e-mail address, and a name 
of person are stored corresponding to each proper log-in name 
assigned to each user for log-in to the central apparatus 1. 

20 FIG. 5 is a diagram showing the record layout of 

communication history storage file 152. As shown in the figure, 
communication history is stored for each terminal apparatus 2, that 
is to say each user log-in name. In the communication history 
storage file 152, anti- virus software code and a detected computer 

25 virus are stored when each terminal apparatus 2 transmits 
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information. The anti-virus software code field stores the 
anti-virus software code of the anti-virus software installed in 
central apparatus 1 at the time of information transmission. When 
the anti-virus software is executed and detects a computer virus, 
5 the detected virus name is stored in the anti-virus software code 
field. When the anti-virus software is executed but detects no 
computer virus, information (a cross mark in the figure) indicating 
no detection is stored in the anti-virus software code field. 

FIG. 6 is a flow chart showing the process sequence of the 

10 computer virus infection information providing system according to 
the invention. When a new computer virus is found out, central 
apparatus 1 stores the time of find-out into anti-virus software 
installation file 151 (step S6l). When anti-virus software for 
detecting and removing the found-out computer virus is prepared, 

15 central apparatus 1 installs the anti- virus software on anti- virus 
software installation file 151 (step S62). Central apparatus 1 
further stores the time of installation of the anti-virus software 
corresponding to the anti- virus software (step S62). 

In the anti- virus software installation file 151, the time of 

20 find-out of the computer virus, the time of installation of the 

anti- virus software, and the anti- virus software (not shown) are 
stored corresponding to a proper anti-virus software code for 
specifying the anti-virus software as shown in FIG. 3. It should be 
noted that the time interval necessary to prepare the anti-virus 

25 software causes an inevitable time lag in the time of installation of 
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the anti-virus software from the time of find-out of the computer 
virus. 

Central apparatus 1 further stores the communication 
history of each terminal apparatus 2 into the communication 
5 history storage file 152 (step S63X More specifically, central 

apparatus 1 stores the time when terminal apparatus 2 transmitted 
information to central apparatus 1 and other information 
corresponding to the log-in name as shown in FIG. 5. Further, 
central apparatus 1 may store a log-in time and a log-out time as 

10 the communication history. 

When terminal apparatus 2 transmits information via 
central apparatus 1, central apparatus 1 determines the presence or 
absence of a computer virus in the information by using the 
installed anti- virus software. When a computer virus is detected, 

15 central apparatus 1 specifies the time of infection of terminal 

apparatus 2 with the computer virus based on the communication 
history and the like (step S64). Central apparatus 1 further 
specifies the route of infection (step S65). The detailed process 
sequence of specifying the time and route of infection is described 

20 later. 

Central apparatus 1 transmits computer virus infection 
information including the specified time and route of infection, the 
detected computer virus name, and the method of treatment, and 
the like, to terminal apparatus 2 with reference to the e-mail 
25 address stored in user file 153 (step S66). Terminal apparatus 2 
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displays the transmitted infection information onto the unshown 
display section 13 such as a liquid crystal display (step S67). The 
contents of the display is described later. 

FIG. 7 is a flow chart showing the process sequence of 
5 specifying the time of infection and of specifying the route of 

infection. Central apparatus 1 determines the presence or absence 
of a computer virus in the information transmitted by terminal 
apparatus 2 (step S7l). More specifically, central apparatus 1 uses 
the latest version of the anti-virus software installed in anti-virus 
10 software installation file 151. Then, central apparatus 1 

determines whether the file contains a computer virus or not by 
performing matching process and the like onto the file name or the 
file contents of the transmitted file. 

When no computer virus is detected (NO in step S71), 
15 central apparatus 1 stores the information indicating no detection 
into the detected computer virus field of communication history 
storage file 152 (step S72). In FIG. 5, this information is shown by 
a cross mark in the detected computer virus field. Central 
apparatus 1 further stores the anti-virus software code of the 
20 anti-virus software used in the computer virus check into the 
anti-virus software code field. 

When a computer virus is detected (YES in step S71), central 
apparatus 1 refers to communication history storage file 152, 
thereby reading out the time of the previous information 
25 transmission (step S73). Then, central apparatus 1 also stores the 
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detected computer virus name into the detected computer virus field 
corresponding to the time of the present information transmission 
as shown in FIG. 5. 

Next, central apparatus 1 refers to anti-virus software 
5 installation file 151, thereby reading out the time of installation of 
the anti-virus software. Central apparatus 1 then compares the 
time of the previous information transmission with the time of 
installation of the anti-virus software, thereby determining whether 
the time of the previous information transmission is before or after 

10 the installation of the anti- virus software (step S74). 

In case that the time of the previous information 
transmission is after the installation of the anti-virus software (YES 
in step S74), central apparatus 1 specifies the time of infection to be 
between the time of the previous information transmission and the 

15 time of installation of the anti-virus software (step S75). 

Further, central apparatus 1 specifies the route of infection 
to be a route other than central apparatus 1 (other than the ISP 
which owns central apparatus l) (step S76). 

That is, after the anti-virus software was installed in central 

20 apparatus 1, computer viruses are completely blocked in the route 
via the ISP which owns central apparatus 1. The fact that no 
computer virus was detected in the previously transmitted 
information under such condition indicates that there was no 
infection with the computer virus at the time of the previous 

25 information transmission. 
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Then, the additional fact that the computer virus is detected 
firstly at the present time indicates that the infection has occurred 
between the time of the previous information transmission and the 
time of the present information transmission, via another ISP or a 
5 computer memory product such as a floppy disk. 

Assumed is the case that a computer virus sends out an 
infective computer virus to each e-mail address stored in the 
address book of a mailer, and that terminal apparatus 2 is infected 
with this computer virus via another ISP. Central apparatus 1 

10 detected no computer virus at the time of the previous information 
transmission. But, central apparatus 1 has detected a computer 
virus at the time of the present information transmission. 
Accordingly, the route of infection is specified to be a route via 
another ISP or a computer memory product such as a floppy disk. 

15 Further, the time of infection is specified to be between the time of 
the previous information transmission and the time of the present 
information transmission. 

In contrast, in case that the time of the previous information 
transmission is not after the installation of the anti- virus software 

20 (NO in step S74), central apparatus 1 specifies the time of infection 
to be between the time of find-out and the time of detection (step 
S77). Further, central apparatus 1 specifies the route of infection 
to be a route via central apparatus 1, another ISP, or a computer 
memory product (step S78). 

25 Such a case is rare. However, one possibility is that the 
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terminal apparatus 2 was infected at an early stage before the 
installation of the anti-virus software into central apparatus 1, that 
is to say before the central apparatus 1 becomes ready to block the 
computer virus. Further, very rare is the case that the terminal 
5 apparatus 2 is infected before the first find-out of the computer 
virus. Accordingly, in this case, central apparatus 1 specifies the 
time of infection to be between the time of find-out and the time of 
the present information transmission. Further, since the 
possibility can not be rejected that the computer virus has passed 

10 through central apparatus 1, central apparatus 1 specifies the route 
of infection to be a route via central apparatus 1, another ISP, or a 
computer memory product such as a floppy disk. 

When central apparatus 1 has specified the time and route of 
infection by the above-mentioned process, central apparatus 1 

15 transmits the infection information to terminal apparatus 2. 

FIG. 8 is a diagram showing an example the display of the 
infection information. As shown in FIG. 8, central apparatus 1 
transmits the specified time and route of infection as an e-mail. At 
the same time, central apparatus 1 provides also the detected 

20 computer virus name and the method of treatment as a part of the 
infection information. 

<Embodiment 2> 

A central apparatus 1 according to Embodiment 2 provides 
anti-virus software to predetermined terminal apparatuses 2. 
25 Further, central apparatus 1 analyzes the execution result of the 
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anti-virus software, thereby providing more detailed infection 
information. 

FIG* 9 is a diagram showing the record layout of a user file 
153 according to Embodiment 2. As shown in FIG. 9, the 
5 information indicating whether a registration is done for receiving 
the anti-virus software or not is stored each anti-virus software 
registration field. A user already registered is indicated with a 
circle mark, while a user not yet registered is indicated with a cross 
mark. In order to receive the anti-virus software, a user needs to 

10 pay a predetermined cost to the ISP which operates central 

apparatus 1. Paying the cost, the user can receive the anti- virus 
software. The anti- virus software is provided every time when a 
new computer virus is found out. By virtue of this scheme, the 
anti-virus software house can reliably collect the development cost 

15 of the anti" virus software via the ISP every time when a new 
computer virus is found out. 

FIG. 10 is block diagram showing the configuration of a 
terminal apparatus 2 according to Embodiment 2. The terminal 
apparatus 2 according to Embodiment 2 has a configuration similar 

20 to that of a well known computer. A CPU 21 is connected through 
a bus 27 to* a RAM 22; a storage section 25 such as a hard disk 
drive?" a communication section 26 such as a modem for 
transmitting and receiving information to and from central 
apparatus l; a display section 24 such as a liquid crystal display; 

25 and an input section 23 such as a keyboard and a mouse. RAM 22 
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stores a control program 22P for controlling storage section 25, 
display section 24, input section 23, and the like. 

Storage section 25 stores anti-virus software down-loaded 
from central apparatus 1. The anti-virus software is loaded up to 
5 RAM 22, thereby detecting computer viruses* The execution result 
is stored in an execution history file 251. 

FIG. 1 1 is a diagram showing the record contents of 
execution history file 251. As shown in the figure, the execution 

■? 

k i result, the executed anti-virus software code, and the detected 

%j 

li 10 computer virus name are stored correspondingly to each time of 

55 execution of the anti-virus software. When a computer virus is 

j detected at the time of execution of the anti-virus software, a flag (a 

□ circle mark in the figure) is stored in execution result field. 

U Further, the detected computer virus name is stored in detected 

:g 15 computer virus field stores. 

FIG. 12A and B are flow chart showing the process sequence 
of the computer virus infection information providing system 
according to Embodiment 2. Similarly to Embodiment 1, central 
apparatus 1 installs anti-virus software against a new computer 
20 virus on anti- virus software installation file 151 (step S101). Then, 
central apparatus 1 determines whether a user is a registered user 
for the anti- virus software or not with reference to user file 153 
(step S102). When central apparatus 1 has determined that the 
user is a registered user for the anti-virus software (YES in step 
25 S102), central apparatus 1 transmits the anti-virus software to the 
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terminal apparatus 2 owned by the registered user, with reference 
to the e-mail address (step S104). 

When central apparatus 1 has determined that the user is 
not a registered user for the anti-virus software (NO in step S102), 
5 central apparatus 1 transmits the advertising information 

concerning the anti-virus software to terminal apparatus 2 (step 
S103). The advertising information is an e-mail stating that the 
anti-virus software is available at a predetermined cost. Here, 
central apparatus 1 transmits the advertising information to the 

10 e-mail address of each user not yet registered for the anti-virus 
software with reference to user file 153. 

FIG. 13 is a diagram showing an illustration of the 
advertising information. The advertising information shown in the 
figure is transmitted. Further, as shown in the figure, central 

15 apparatus 1 transmits a hyperlink to jump to a Web page for the 
anti- virus software registration. By virtue of this system, the 
users not yet registered for the anti-virus software are informed, 
whereby the number of registered users for the anti-virus software 
can be increased. 

20 Terminal apparatus 2 received the anti-virus software 

installs the anti-virus software on storage section 25 (step S105). 
Every time of execution of the anti-virus software, terminal 
apparatus 2 stores the execution history into execution history file 
251 (step S106). When terminal apparatus 2 executes the 

25 anti-virus software, terminal apparatus 2 determines whether a 
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computer virus is detected or not (step S107). When a computer 
virus is detected (YES in step S107), terminal apparatus 2 reads out 
the execution history from execution history file 251. Terminal 
apparatus 2 transmits the execution history to central apparatus 1 
5 (step SI 08). In contrast, when no computer virus is detected (NO 
in step S107), terminal apparatus 2 proceeds to step S106, thereby 
repeating the process* The process steps S105-S108 are described 
later in detail. 

l i Central apparatus 1 received the execution history specifies 

;!f 10 the time of infection (step S109), and further specifies the route of 

Vat? 

1% infection (step S1010). Detail of these process steps are described 

i% later. Central apparatus 1 transmits the infection information 

Ij including the time and route of infection, the detected computer 

%1 virus name, and the method of treatment, to terminal apparatus 2 

r§ 15 (step S1011). Terminal apparatus 2 displays the transmitted 

infection information onto display section 24 (step S1012). 

FIG. 14 is a diagram showing the contents of infection 
information displayed on display section 24, As shown in FIG. 14, 
the infection information such as the time and route of infection is 
20 displayed on display section 24. 

FIG. 15A and B are flow chart showing the process sequence 
of virus check in terminal apparatus 2. Terminal apparatus 2 
installs the anti-virus software transmitted from the central 
apparatus 1, on the storage section 25 (step S141). The terminal 
25 apparatus 2 further stores the time of installation. Terminal 
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apparatus 2 then starts and executes the installed anti-virus 
software, thereby checking the files made before the time of 
installation (step S142). More specifically, terminal apparatus 2 
performs scan and pattern matching onto the files stored in storage 
5 section 25. Terminal apparatus 2 determines whether a computer 
virus is detected or not (step S143). When a computer virus is 
detected (YES in step S143), terminal apparatus 2 stores the 
execution history into execution history file 251 (step S144). After 
that, terminal apparatus 2 reads out the stored execution history, 

10 thereby transmitting execution history of type A to central 

apparatus 1 (step S145). The transmitted information includes- 
the address of terminal apparatus 2; the time of execution of the 
anti-virus software; the file name of the detected computer virus; 
the time of update of the file; and the execution history type (any 

15 one of type A to type C). 

In contrast, when no computer virus is detected (NO in step 
S143), terminal apparatus 2 stores the execution history into 
execution history file 251 (step S146). After that, terminal 
apparatus 2 determines whether the anti-virus software is of a 

20 RAM resident type or not (step S147). That is, there are two types 
of anti-virus software. One type is a RAM resident type which 
resides in RAM 22, thereby checking computer viruses every time of 
file operation, while the other type is a RAM non-resident type 
which is executed every time interval (for example, every 5 hours). 

25 Since the specification of the time of infection depends on the these 
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types, terminal apparatus 2 caries out the following steps. 

When the anti-virus software is of RAM resident type (YES 
in step S147), terminal apparatus 2 executes the anti-virus software 
every time of file operation. Terminal apparatus 2 determines 
5 whether a computer virus is detected or not (step S148). When no 
computer virus is detected (NO in step SI 48), terminal apparatus 2 
stores the execution history into execution history file 251 (step 
S149). After that, terminal apparatus 2 proceeds to step S148, 
thereby repeating the process. In contrast, when a computer virus 

10 is detected (YES in step S148), terminal apparatus 2 stores the 

execution history into execution history file 251 (step S1410). After 
that, terminal apparatus 2 reads out the stored execution history, 
thereby transmitting execution history of type B to central 
apparatus 1 (step S1411). 

15 On the other hand, when the anti- virus software is of RAM 

non-resident type (NO in step S147), terminal apparatus 2 checks 
computer viruses every predetermined time interval. Terminal 
apparatus 2 determines whether a computer virus is detected or not 
(step S1412). When no computer virus is detected (NO in step 

20 S1412), terminal apparatus 2 stores the execution history into 
execution history file 251 (step S1413). After that, terminal 
apparatus 2 proceeds to step S1412, thereby repeating the process. 
In contrast, when a computer virus is detected (YES in step S1412), 
terminal apparatus 2 stores the execution history into execution 

25 history file 251 (step S1414). After that, terminal apparatus 2 
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reads out the stored execution history, thereby transmitting 
execution history of type C to central apparatus 1 (step S1415). 

FIG. 16 is a flow chart showing the process sequence of 
specifying the time and route of infection. The process according to 
5 the invention is branching into the following sub -processes 

depending on the execution history of types A to C transmitted from 
terminal apparatus 2. First, central apparatus 1 determines 
whether the transmitted execution history is of type A or not (step 
~~ S151). When the execution history is of type A (YES in step S151), 

^ 10 central apparatus 1 specifies the time of infection to be between the 
m time of find-out of the computer virus and the time of installation of 

fjj the anti-virus software into terminal apparatus 2 (step S152). 

g" Further, central apparatus 1 specifies the route of infection to be a 

SI route via central apparatus 1, another ISP, or a computer memory 

rii 15 product (step S153). That is, the infection has occurred before the 
M installation of the anti- virus software into terminal apparatus 2. 

Accordingly, the time of infection is specified to be before the 
installation of the anti- virus software into terminal apparatus 2. 
Further, the possibility can not be rejected that the infection has 
20 occurred via the ISP which owns central apparatus 1. 

When the execution history is not of type A (NO in step 
Si 51), central apparatus 1 determines whether the transmitted 
execution history is of type B or not (step SI 54). When the 
execution history is of type B (YES in step SI 54), that is, when the 
25 anti-virus software is of RAM resident type, central apparatus 1 
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specifies the time of infection to be the time when the anti-virus 
software is executed at the present time (step S155). That is, the 
anti-virus software of RAM resident type checks computer viruses 
at each time of file operation in real time, thereby specifies the time 
5 of infection completely. 

Further, central apparatus 1 specifies the route of infection 
to be a route via another ISP other than central apparatus 1, or via 
a computer memory product (step SI 56). That is, in step S143, no 
computer virus was present before the installation of the anti-virus 
10 software into terminal apparatus 2. Further, a computer virus is 
detected after the installation of the anti" virus software. 
Accordingly, the route of infection is specified to be a route via 
another ISP other than central apparatus 1, or via a computer 
memory product. 

15 When the execution history is not of type B (NO in step 

SI 54), that is, when the anti-virus software is of RAM non-resident 
type (type c), central apparatus 1 specifies the time of infection to be 
between the time when the anti-virus software is executed at the 
previous time and the time when the anti-virus software is executed 

20 at the present time (step S157). That is, the anti-virus software of 
RAM non-resident type checks computer viruses every 
predetermined time interval. Accordingly, with reference to the 
execution history, the time of infection is specified to be between the 
time of the previous execution and the time of the present 

25 execution. 
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Further, central apparatus 1 specifies the route of infection 
to be a route via another ISP other than central apparatus 1, or via 
a computer memory product (step S158). That is, in step S143, no 
computer virus was present before the installation of the anti-virus 
software into terminal apparatus 2. Further, a computer virus is 
detected after the installation of the anti-virus software. 
Accordingly, the route of infection is specified to be a route via 
another ISP other than central apparatus 1, or via a computer 
memory product. 

<Embodiment 3> 

FIG. 17 is a schematic diagram showing a general 
configuration according to Embodiment 3 of the invention. As 
shown in Embodiment 3, the computer program for causing central 
apparatus 1 according to Embodiments 1 and 2 to execute can be 
distributed in a manner in which the computer program is 
pre-installed in central apparatus 1, or alternatively in a form of a 
portable computer memory product such as a CD-ROM and an MO. 
Further, the computer program can be distributed by being 
propagated as a carrier wave via a network. The contents are 
described below. 

A computer memory product la (a CD-ROM, an MO, a 
DVD-ROM, or the like) having recorded a computer program for 
causing a central apparatus 1 shown in FIG. 17 to store the 
communication history and thereby to specify the time of infection 
is installed in a storage section 15 of the central apparatus 1. The 
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computer program is loaded up to a RAM 12 of the central 
apparatus 1, thereby being executed. By virtue of this, the 
computer program serves as the above-mentioned central apparatus 
1 according to the invention. 

As this invention may be embodied in several forms without 
departing from the spirit of essential characteristics thereof, 
present embodiments are therefore illustrative and not restrictive, 
since the scope of the invention is defined by the appended claims 
rather than by the description preceding them, and all changes that 
fall within metes and bounds of the claims, or equivalent of such 
metes and bounds thereof are therefore intended to me embraced by 
the claims. 



